Governed memory for AI agents

Memory that can’t misquote you.

Shomei admits verbatim, byte-grounded spans instead of asking a model to smooth a conversation into new prose. The source stays attached; unsupported detail stays out.

Try it yourself See the audited results

Memory that can carry weight

A wrong answer is forgotten by morning. An invented memory is still there next year, quoted as fact.

The moment an agent acts on what it remembers, a dose, a contract term, a balance, "usually right" is disqualifying. And unlike an answer, a memory is never re-checked. It becomes the ground truth for everything that follows: it persists, resurfaces on the next recall as established history, and biases every decision after it. One wrong answer is an incident. One invented memory is a standing liability, and a system holding thousands of memories at even a 1% invention rate is carrying dozens of them at once. Most systems ask a model to rewrite a conversation into tidy new sentences, and that is where detail gets invented. Shomei saves only words that actually appeared in the source, copied exactly and checkable against it. If a claim is not backed by the text, it never becomes a memory. The system abstains instead of guessing.

Why a 1% per-memory rate is a category problem, not a rounding error

A wrong answer is spent the moment it is given. It is on screen, it can be challenged, and it is gone when the conversation ends. A fabricated memory is different: it is stored, it resurfaces on later recalls as established history, and every decision downstream inherits it. Errors in answers wash out. Errors in memory accumulate.

Measured (this synthetic suite, ungated extractors):The weaker of the two production extractors invented memories at 1.63% (GPT-4.1-mini), the better at 0.91% (Claude Haiku), and the deterministic proposer at 0.22%. Roughly one invented memory in every sixty to one hundred for the LLM extractors.

Projected (illustrative volume applied to the measured rates, not a production estimate):

An agent storing about 10 memories a day about one person accumulates ~3,650 memories in a year. At 1.63% that is about 60 invented facts carried as that person's history. At 0.91%, about 33. Even the deterministic 0.22% projects to about 8.
The break-even is small: at 1.63%, it takes only about 42 stored memories before the odds of carrying at least one fabrication cross 50%. Most real agent relationships pass that in a week.

The point: lowering the rate does not remove the failure mode. Any nonzero invention rate accumulates under recall, so the only rate that does not compound is zero. Deletion cannot save you either, because you cannot erase a fabrication you never knew was false. Shomei admits only verbatim, byte-grounded spans, so across all 5,001 synthetic cases the count of invented memories admitted was zero of 15,003, enforced mechanically by the gate.

5,001 high-stakes synthetic cases; legal, clinical, insurance, financial; preregistered; committed artifacts.

We ran three memory-writers over the same 5,001 conversations: two cost-tier production extractors teams actually deploy (GPT-4.1-mini, Claude Haiku) and one deterministic rule-based proposer. Each proposed about 20,000 memories. Every proposal had to clear the same test: is this an exact substring of the source, or not? The gate checks bytes, not the model, so it treats all three identically. Each case was built to include a paraphrase-tempting fact, so these rates reflect an adversarial stress design, not a production-population estimate.

Synthetic suite 558 / 558

invented proposals blocked by the gate

Synthetic suite 15,003

admitted memories, each an exact span of its source

Synthetic suite 369

audit rows independently re-checked by GPT-5.4

Synthetic suite
Memory-writer	Invented raw	Blocked by gate	Admitted verbatim
GPT-4.1-mini	330 / 20,223 (1.63%)	330 / 330	5,001 / 5,001
Claude Haiku	184 / 20,217 (0.91%)	184 / 184	5,001 / 5,001
Deterministic proposer	44 / 20,004 (0.22%)	44 / 44	5,001 / 5,001

Ungated, the weaker production extractor invents roughly one memory in sixty, the better one in a hundred. The gate admits only exact substrings of the source, so a fabrication cannot pass whether or not a judge catches it. The judge counts are a lower bound on fabrications attempted, not the gate's guarantee.

Show me the proof.

Every admitted memory is a span you can check yourself. Here is one, from a clinical case in the suite.

SOURCE

The follow-up note for fas-cli-org-0001 entered the clinical-review queue. The study clinician owns review round 2. The protocol monitor will check the synthetic study record on Tuesday. The next team update is scheduled for September 7, 2026.

ADMITTED

"The study clinician owns review round 2." bytes [75:115]
"The next team update is scheduled for September 7, 2026." bytes [187:243]

REFUSED

"The update is due in early September." (not present verbatim in the source)

Each admitted memory is a substring at the offsets shown. You can copy the source and check every span by string comparison. A paraphrase that changes the words, even to something true-sounding, is not a substring, so it never becomes a memory.

Synthetic suite

15,003 admitted memories, each an exact span of its source

Because memories compound, the only safe fabrication rate is zero, and that guarantee is mechanical, not editorial.

Every admitted memory is a verbatim substring of its source conversation: not paraphrased, not summarized, not judged faithful by a model. The gate compares bytes and admits only an exact span, so a fabrication cannot pass regardless of whether any judge catches it. Across all 5,001 cases, every one of the 15,003 admitted memories cleared the gate. An independent GPT-5.4 audit re-checked a stratified 369-row sample and flagged three admitted rows the population judge had marked unfaithful; each of the three is a byte-exact substring of its source, verifiable by string comparison against the offsets shown. The judge produced three false-unfaithful labels; the gate produced zero false admits.

Method: fully synthetic CC0 suite, preregistered, frozen corpus (SHA committed). Faithfulness scored by an LLM population judge, re-audited by GPT-5.4; the three disputed admissions founder-adjudicated. A synthetic-suite result is not a production-population rate.

Speed · query at 100k

~5.7× faster

The optimized scan returned byte-identical output, with a SHA-256 match on all 26 queries.

Caveat: p95 over 26 near-max samples in a single run; elapsed milliseconds are approximate, while the speedup and byte identity are the robust claims.

Deletion · 100k tier

0 readable residue

Erase a subject and a forensic byte-scan finds nothing readable; a co-tenant’s 40,000 memories remain untouched.

Caveat: 100k = 10 tenants × 10k, not 100k per tenant; 2 crash-under-load scenarios were skipped.

Where we win · long-history recall

69.2 vs 54.9

On LongMemEval, governed long-history retrieval beats brute-force full-context by +14.3 pts answerable, on a neutral GPT-4o judge. Retrieving the right span beats stuffing everything into the prompt.

Caveat: n=91 answerable (a sample, not the full 500); a neutral gpt-5.4-mini judge corroborates at 65.9 vs 54.9; the first reranker pass measured cosine (onnxruntime absent).

Where we lose · LoCoMo

0.38 vs 0.54

On LoCoMo multi-hop, governed recall currently trails plain dense RAG. We publish the loss because a benchmark page that only wins isn’t one.

Caveat: recall uses an approximate token-containment matcher (threshold 0.55); ~84% of the gap is extraction coverage, not ranking.

Method, without the gloss.

Recall: LoCoMo recall uses an approximate token-containment matcher. Every headline is reviewed against a committed private artifact; raw evidence stays out of the public HTML.